PiDevCfgCopyDeviceKey
NTSTATUS __stdcall PiDevCfgCopyDeviceKey(_HANDLE KeyHandle, INT64 a2, INT64 a3, INT64 a4){
_PI_DEVCFG_RESOLVE_CONTEXT *v4;
unsigned int v5;
INT64 v6;
int RegistryKeyInformation;
ULONG v8;
ULONG v9;
ULONG v10;
unsigned int *PoolWithTag;
unsigned int i;
NTSTATUS v13;
_LIST_ENTRY *v14;
void *v15;
VOID *v16;
unsigned int j;
NTSTATUS v18;
const wchar_t *v19;
int v21;
unsigned int v22;
bool v23;
int v24;
void *v25;
_OBJECT_TYPE *v26;
unsigned int *v27;
unsigned int v28;
unsigned int MaximumLength;
char *Buffer;
unsigned int v31;
NTSTATUS v32;
const WCHAR *v33;
char v34;
NTSTATUS v35;
PNP_OBJECT_TYPE v36;
int v37;
WCHAR *v38;
NTSTATUS v39;
char v40;
NTSTATUS v41;
INT64 v42;
INT64 v43;
INT64 v44;
_PI_DEVCFG_RESOLVE_CONTEXT *v45;
UINT64 v46;
int v47;
char v48;
UINT64 v49;
NTSTATUS v50;
char *PropertySize;
int v52;
int v53;
NTSTATUS v54;
UINT64 v55;
__int64 v56;
VOID *v57;
char v58;
NTSTATUS v59;
int v60;
INT64 v61;
NTSTATUS v62;
INT64 v63;
VOID *v64;
UINT64 v65;
int v66;
__int64 v67;
UINT64 Length;
UINT64 *ResultLength;
UINT64 *ResultLengtha;
UINT64 *ResultLengthb;
UINT64 *ResultLengthc;
UINT64 *ValueSizeResult;
VOID **ValueDataResult;
_DEVPROPKEY *p_TargetPropertySize;
INT64 v76;
WCHAR *PropertyLocaleName;
UINT64 VariableModifiers;
VOID *SourceKeyHandle;
VOID *TargetKeyHandle;
__int64 v81;
PVOID P;
VOID *KeySecurityDescriptor;
UINT64 TargetPropertySize;
_KEY_FULL_INFORMATION *Information;
WCHAR *ValueName[2];
VOID *Data;
_PI_DEVCFG_RESOLVE_CONTEXT *ResolveContext;
UINT64 PropertyType;
unsigned int v90;
char Disposition[12];
PNP_OBJECT_TYPE v92[2];
_UNICODE_STRING VariableName;
_OBJECT_ATTRIBUTES ObjectAttributes;
_UNICODE_STRING v95;
VOID *KeyHandlea;
_LIST_ENTRY *CopyKeyStack;
_UNICODE_STRING v98;
_UNICODE_STRING DestinationString;
_DEVPROPKEY PropertyKey;
unsigned int v101;
_LIST_ENTRY *v102;
_PI_DEVCFG_RESOLVE_CONTEXT *v103;
v4 = v103;
KeyHandlea = *(VOID **)&KeyHandle;
PropertyLocaleName = (WCHAR *)a2;
CopyKeyStack = v102;
HIDWORD(PropertyType) = a4;
*(_QWORD *)v92 = a3;
v5 = a4;
ResolveContext = v103;
v6 = a3;
SourceKeyHandle = 0i64;
memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
TargetKeyHandle = 0i64;
KeySecurityDescriptor = 0i64;
v98 = 0i64;
Information = 0i64;
v95 = 0i64;
memset(Disposition, 0, sizeof(Disposition));
DestinationString = 0i64;
LODWORD(PropertyType) = 1;
*(_OWORD *)ValueName = 0i64;
VariableName = 0i64;
v76 = 0i64;
memset(&PropertyKey, 0, sizeof(PropertyKey));
LODWORD(TargetPropertySize) = 0;
RegistryKeyInformation = IopGetRegistryKeyInformation(*(PVOID *)&KeyHandle, &Information);
if( RegistryKeyInformation < 0 )
goto LABEL_19;
v8 = 2 * Information->MaxNameLen + 26;
HIDWORD(v76) = 2 * Information->MaxValueNameLen + 18;
v9 = HIDWORD(v76);
if( HIDWORD(v76) <= v8 )
v9 = v8;
v10 = v9;
v81 = v9;
ExFreePoolWithTag(Information, 0);
PoolWithTag = (unsigned int *)ExAllocatePoolWithTag(1ui64, v10, 1667526736i64);
Information = (_KEY_FULL_INFORMATION *)PoolWithTag;
if( !PoolWithTag )
{
RegistryKeyInformation = -1073741670;
goto LABEL_19;
}
for( i = 0; ; ++i )
{
LODWORD(Length) = v10;
v90 = i;
v13 = ZwEnumerateValueKey(
KeyHandlea,
i,
KeyValueBasicInformation,
PoolWithTag,
Length,
(UINT64 *)((char *)&v76 + 4));
RegistryKeyInformation = v13;
if( v13 >= 0 )
{
v21 = 0;
*((_WORD *)PoolWithTag + ((unsigned __int64)PoolWithTag[2] >> 1) + 6) = 0;
RegistryKeyInformation = RtlInitUnicodeStringEx(&DestinationString, (WCHAR *)PoolWithTag + 6);
if( RegistryKeyInformation < 0 )
goto LABEL_110;
*(_UNICODE_STRING *)ValueName = DestinationString;
LODWORD(VariableModifiers) = 0;
if( v4 )
{
if( *((_QWORD *)v4 + 2) )
{
PiDevCfgParseVariableName(DestinationString.Buffer, &VariableName, &VariableModifiers);
v21 = VariableModifiers;
if( v40 )
{
if( (VariableModifiers & 0x400000) != 0 )
goto LABEL_64;
P = 0i64;
v41 = PiDevCfgResolveVariable(v4, VariableName.Buffer, (_PI_DEVCFG_VARIABLE_ENTRY **)&P);
if( v41 >= 0 )
{
if( (unsigned int)(*((_DWORD *)P + 8) - 1) > 1 || *((_DWORD *)P + 9) > 0xFFFEu )
goto LABEL_64;
ValueName[1] = *((WCHAR **)P + 5);
LOWORD(ValueName[0]) = *((_WORD *)P + 18) - 2;
WORD1(ValueName[0]) = *((_WORD *)P + 18);
}
else
{
if( v41 != -1073741772 )
goto LABEL_64;
*(_UNICODE_STRING *)ValueName = VariableName;
}
}
}
}
v22 = PoolWithTag[1] & 0xFFFF0000;
*((_WORD *)PoolWithTag + 3) = 0;
if( (v22 & 0x400000) != 0 )
goto LABEL_64;
if( v6 )
{
PiDevCfgParsePropertyKeyName((_UNICODE_STRING *)ValueName, &PropertyKey, &PropertyType);
if( !v48 )
goto LABEL_64;
}
v23 = (v101 & 1) != 0;
v24 = v21 | v22;
if( (v24 & 0x30000) != 0 || !v23 )
{
if( v6 )
{
p_TargetPropertySize = (_DEVPROPKEY *)&TargetPropertySize;
if( PnpGetObjectProperty(
*(&stru_140CF2E80 + 1214),
v6,
v5,
(INT64)PropertyLocaleName,
0i64,
(INT64)&PropertyKey,
(INT64)&v76,
0i64) != -1073741789 )
{
LABEL_32:
if( (v24 & 0x10000) == 0 )
goto LABEL_33;
LABEL_63:
v4 = ResolveContext;
LABEL_64:
v10 = v81;
continue;
}
}
else if( !PnpRegistryValueExists(PropertyLocaleName, (_UNICODE_STRING *)ValueName) )
{
goto LABEL_32;
}
if( (v24 & 0x20000) != 0 || !v23 )
goto LABEL_63;
}
LABEL_33:
P = 0i64;
v25 = 0i64;
Data = 0i64;
RegistryKeyInformation = IopGetRegistryValue(
KeyHandlea,
DestinationString.Buffer,
0i64,
(_KEY_VALUE_FULL_INFORMATION **)&P);
if( RegistryKeyInformation < 0 )
goto LABEL_110;
v27 = (unsigned int *)P;
v28 = *((_DWORD *)P + 1) & 0xFFFF0000;
MaximumLength = *((_DWORD *)P + 3);
Buffer = (char *)P + *((unsigned int *)P + 2);
v31 = (unsigned __int16)*((_DWORD *)P + 1);
if( ResolveContext
&& *((_QWORD *)ResolveContext + 2)
&& v31 - 1 <= 1
&& PnpValidateStringData((__int64)P + *((unsigned int *)P + 2), MaximumLength)
&& (PiDevCfgParseVariableName(v33, &VariableName, &VariableModifiers), v34) )
{
Buffer = (char *)VariableName.Buffer;
P = 0i64;
v35 = PiDevCfgResolveVariable(ResolveContext, VariableName.Buffer, (_PI_DEVCFG_VARIABLE_ENTRY **)&P);
RegistryKeyInformation = v35;
if( v35 < 0 )
{
RegistryKeyInformation = 0;
if( v35 == -1073741772 )
MaximumLength = VariableName.MaximumLength;
else
Buffer = 0i64;
goto LABEL_49;
}
if( (VariableModifiers & 0xC0000) == 0 )
{
MaximumLength = *((_DWORD *)P + 9);
Buffer = (char *)*((_QWORD *)P + 5);
v31 = (unsigned __int16)*((_DWORD *)P + 8);
v28 |= *((_DWORD *)P + 8) & 0xFFFF0000;
goto LABEL_49;
}
v32 = PiDevCfgResolveMultiSzValue(
*((unsigned int *)P + 8),
*((unsigned int *)P + 9),
*((VOID **)P + 5),
(unsigned int)VariableModifiers,
PropertyLocaleName,
ValueName[1],
(UINT64 *)((char *)&v76 + 4),
&Data);
}
else
{
if( v31 != 7 && v31 - 1 > 1 || (v28 & 0xC0000) == 0 )
goto LABEL_49;
v32 = PiDevCfgResolveMultiSzValue(
v31,
MaximumLength,
Buffer,
v28,
PropertyLocaleName,
ValueName[1],
(UINT64 *)((char *)&v76 + 4),
&Data);
}
v25 = Data;
RegistryKeyInformation = v32;
if( v32 < 0 )
{
Buffer = 0i64;
RegistryKeyInformation = 0;
}
else
{
MaximumLength = HIDWORD(v76);
v31 = 7;
Buffer = (char *)Data;
if( HIDWORD(v76) >= 2 && !*(_WORD *)Data )
v28 |= 0x200000u;
}
LABEL_49:
if( Buffer )
{
if( v31 == 0x8000 )
{
if( !*(_QWORD *)v92 )
{
v38 = PropertyLocaleName;
if( !CopyKeyStack )
goto LABEL_56;
v55 = (v28 & 0x20000) == 0;
LODWORD(v55) = v55 | 0x80000000;
PiDevCfgPushCopyKeyEntry(CopyKeyStack, Buffer, PropertyLocaleName, v55);
goto LABEL_55;
}
}
else if( v31 || (v28 & 0x100000) == 0 )
{
v36 = v92[0];
v37 = v28 & 0x200000;
if( !*(_QWORD *)v92 )
{
if( v37 )
{
v38 = PropertyLocaleName;
RegistryKeyInformation = ZwDeleteValueKey(PropertyLocaleName, (_UNICODE_STRING *)ValueName, v26);
if( RegistryKeyInformation == -1073741772 )
RegistryKeyInformation = 0;
goto LABEL_56;
}
LODWORD(ResultLength) = MaximumLength;
v38 = PropertyLocaleName;
v39 = ZwSetValueKey(
PropertyLocaleName,
(_UNICODE_STRING *)ValueName,
*v27,
v31,
Buffer,
(UINT64)ResultLength);
LABEL_55:
RegistryKeyInformation = v39;
LABEL_56:
if( v25 )
ExFreePoolWithTag(v25, 0);
v6 = *(_QWORD *)v92;
if( !*(_QWORD *)v92 && v31 != 0x8000 && (v28 & 0x100000) != 0 )
{
if( *(&stru_140CF2E80 + 607) && (v56 = *(_QWORD *)(*(&stru_140CF2E80 + 607) + 224i64)) != 0 )
v57 = *(VOID **)(v56 + 8);
else
v57 = 0i64;
RegRtlDeleteTreeInternal(v38, ValueName[1], v57, 0);
}
ExFreePoolWithTag(v27, 0);
if( RegistryKeyInformation < 0 )
goto LABEL_110;
PoolWithTag = (unsigned int *)&Information->LastWriteTime;
i = v90;
v5 = HIDWORD(PropertyType);
goto LABEL_63;
}
if( v37 )
{
v52 = 0;
*(_QWORD *)&Disposition[4] = 0i64;
v53 = 0;
LODWORD(v76) = 0;
LODWORD(TargetPropertySize) = 0;
PropertySize = 0i64;
goto LABEL_101;
}
if( (_DWORD)PropertyType != 1 )
{
v49 = (unsigned int)PropertyType;
LODWORD(v76) = PropertyType;
LABEL_100:
v50 = PiDevCfgConvertPropertyFromValue(
v31,
MaximumLength,
Buffer,
v49,
&TargetPropertySize,
(VOID **)&Disposition[4]);
PropertySize = *(char **)&Disposition[4];
RegistryKeyInformation = v50;
v52 = v76;
v53 = TargetPropertySize;
v36 = v92[0];
LABEL_101:
if( RegistryKeyInformation >= 0 && (PropertySize || !v52) )
{
LODWORD(p_TargetPropertySize) = v53;
LODWORD(ValueDataResult) = v52;
v54 = PiDevCfgSetObjectProperty(
*(&stru_140CF2E80 + 607),
0i64,
v36,
(WCHAR *)HIDWORD(PropertyType),
PropertyLocaleName,
ResultLength,
(UINT64)&PropertyKey,
(WCHAR *)ValueDataResult,
(UINT64)PropertySize,
p_TargetPropertySize);
RegistryKeyInformation = v54;
if( v54 == -1073741790 || !(_DWORD)v76 && v54 == -1073741275 )
RegistryKeyInformation = 0;
if( PropertySize )
{
if( PropertySize != Buffer )
ExFreePoolWithTag(PropertySize, 0);
*(_QWORD *)&Disposition[4] = 0i64;
}
}
goto LABEL_109;
}
if( v31 )
{
if( v31 <= 2 )
{
v49 = 18i64;
goto LABEL_143;
}
switch( v31 )
{
case 4u:
v49 = 7i64;
goto LABEL_143;
case 7u:
v49 = 8210i64;
goto LABEL_143;
case 0xBu:
v49 = 9i64;
LABEL_143:
LODWORD(v76) = v49;
goto LABEL_100;
}
}
v49 = 4099i64;
goto LABEL_143;
}
}
LABEL_109:
v38 = PropertyLocaleName;
goto LABEL_56;
}
if( v13 == -2147483622 )
{
RegistryKeyInformation = 0;
goto LABEL_9;
}
if( v13 != -2147483643 )
goto LABEL_158;
ExFreePoolWithTag(PoolWithTag, 0);
v10 = HIDWORD(v76);
v81 = HIDWORD(v76);
Information = (_KEY_FULL_INFORMATION *)ExAllocatePoolWithTag(1ui64, HIDWORD(v76), 1667526736i64);
PoolWithTag = (unsigned int *)&Information->LastWriteTime;
if( !Information )
break;
--i;
}
RegistryKeyInformation = -1073741670;
LABEL_158:
if( RegistryKeyInformation < 0 )
goto LABEL_110;
LABEL_9:
if( v6 )
{
LABEL_110:
v15 = KeySecurityDescriptor;
goto LABEL_15;
}
v14 = CopyKeyStack;
v15 = KeySecurityDescriptor;
if( CopyKeyStack )
{
v16 = KeyHandlea;
for( j = 0; ; ++j )
{
LODWORD(Length) = v10;
v18 = ZwEnumerateKey(v16, j, KeyBasicInformation, PoolWithTag, Length, (UINT64 *)((char *)&v76 + 4));
v19 = 0i64;
RegistryKeyInformation = v18;
if( v18 >= 0 )
break;
if( v18 == -2147483622 )
{
RegistryKeyInformation = 0;
goto LABEL_15;
}
if( v18 != -2147483643 )
goto LABEL_15;
ExFreePoolWithTag(PoolWithTag, 0);
v10 = HIDWORD(v76);
v81 = HIDWORD(v76);
Information = (_KEY_FULL_INFORMATION *)ExAllocatePoolWithTag(1ui64, HIDWORD(v76), 1667526736i64);
PoolWithTag = (unsigned int *)&Information->LastWriteTime;
if( !Information )
{
RegistryKeyInformation = -1073741670;
goto LABEL_15;
}
--j;
LABEL_92:
;
}
*((_WORD *)PoolWithTag + ((unsigned __int64)PoolWithTag[3] >> 1) + 8) = 0;
RegistryKeyInformation = RtlInitUnicodeStringEx(&v98, (WCHAR *)PoolWithTag + 8);
if( RegistryKeyInformation < 0 )
goto LABEL_15;
v95 = v98;
ObjectAttributes.Length = 48;
ObjectAttributes.RootDirectory = v16;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
ObjectAttributes.ObjectName = &v98;
RegistryKeyInformation = ZwOpenKey(
&SourceKeyHandle,
0x20019ui64,
&ObjectAttributes,
v42,
Length,
(INT64)ResultLengtha,
(INT64)ValueSizeResult,
(INT64)ValueDataResult);
if( RegistryKeyInformation < 0 )
goto LABEL_15;
v45 = ResolveContext;
LODWORD(VariableModifiers) = 0;
if( ResolveContext )
{
if( *((_QWORD *)ResolveContext + 2) )
{
PiDevCfgParseVariableName(v98.Buffer, &VariableName, &VariableModifiers);
if( v58 )
{
P = 0i64;
v59 = PiDevCfgResolveVariable(v45, VariableName.Buffer, (_PI_DEVCFG_VARIABLE_ENTRY **)&P);
if( v59 < 0 )
{
if( v59 != -1073741772 )
goto LABEL_168;
v95 = VariableName;
}
else
{
v60 = *((_DWORD *)P + 8);
if( (unsigned int)(v60 - 1) > 1 )
{
if( v60 == 7 )
{
v19 = (const wchar_t *)*((_QWORD *)P + 5);
goto LABEL_75;
}
LABEL_168:
ZwClose((_HANDLE)SourceKeyHandle);
SourceKeyHandle = 0i64;
LABEL_91:
v10 = v81;
goto LABEL_92;
}
v95.Buffer = (wchar_t *)*((_QWORD *)P + 5);
v95.Length = *((_WORD *)P + 18) - 2;
v95.MaximumLength = *((_WORD *)P + 18);
}
}
}
}
LABEL_75:
RegistryKeyInformation = PiDevCfgGetKeySecurityDescriptor(
SourceKeyHandle,
&KeySecurityDescriptor,
v43,
v44,
Length,
(INT64)ResultLengthb,
(INT64)ValueSizeResult,
(INT64)ValueDataResult);
if( RegistryKeyInformation >= 0 )
{
v15 = KeySecurityDescriptor;
}
else
{
RegistryKeyInformation = 0;
KeySecurityDescriptor = 0i64;
v15 = 0i64;
}
if( !v19 )
{
ObjectAttributes.RootDirectory = PropertyLocaleName;
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &v95;
ObjectAttributes.Attributes = 576;
LODWORD(ResultLengthc) = 0;
ObjectAttributes.SecurityDescriptor = v15;
ObjectAttributes.SecurityQualityOfService = 0i64;
RegistryKeyInformation = ZwCreateKey(
&TargetKeyHandle,
0xF003Fui64,
&ObjectAttributes,
0i64,
0i64,
(UINT64)ResultLengthc,
(UINT64 *)Disposition);
if( RegistryKeyInformation >= 0 )
{
if( *(_DWORD *)Disposition == 2 && v15 )
ZwSetSecurityObject((UINT64)TargetKeyHandle, 4ui64, (INT64)v15);
v46 = v101;
LODWORD(v46) = v101 | 0x40000000;
PiDevCfgPushCopyKeyEntry(v14, SourceKeyHandle, TargetKeyHandle, v46);
RegistryKeyInformation = v47;
if( v47 < 0 )
ZwClose((_HANDLE)TargetKeyHandle);
SourceKeyHandle = 0i64;
LABEL_85:
TargetKeyHandle = 0i64;
}
LABEL_86:
if( v15 )
{
ExFreePoolWithTag(v15, 0);
v15 = 0i64;
KeySecurityDescriptor = 0i64;
}
if( SourceKeyHandle )
{
ZwClose((_HANDLE)SourceKeyHandle);
SourceKeyHandle = 0i64;
}
if( RegistryKeyInformation < 0 )
goto LABEL_15;
goto LABEL_91;
}
if( !*v19 )
goto LABEL_86;
while( 2 )
{
RtlInitUnicodeString(&v95, v19);
ObjectAttributes.RootDirectory = PropertyLocaleName;
ObjectAttributes.SecurityQualityOfService = 0i64;
ObjectAttributes.ObjectName = &v95;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 576;
ObjectAttributes.SecurityDescriptor = v15;
v62 = ZwOpenKey(
&TargetKeyHandle,
0xF003Fui64,
&ObjectAttributes,
v61,
Length,
(INT64)ResultLengthc,
(INT64)ValueSizeResult,
(INT64)ValueDataResult);
RegistryKeyInformation = v62;
if( v62 >= 0 )
{
if( v15 )
ZwSetSecurityObject((UINT64)TargetKeyHandle, 4ui64, (INT64)v15);
goto LABEL_181;
}
if( v62 != -1073741772 )
goto LABEL_86;
if( (VariableModifiers & 0x10000) != 0 )
{
RegistryKeyInformation = 0;
}
else
{
LODWORD(ResultLengthc) = 0;
RegistryKeyInformation = ZwCreateKey(
&TargetKeyHandle,
0xF003Fui64,
&ObjectAttributes,
0i64,
0i64,
(UINT64)ResultLengthc,
0i64);
if( RegistryKeyInformation < 0 )
goto LABEL_86;
LABEL_181:
v64 = SourceKeyHandle;
if( !SourceKeyHandle )
{
ObjectAttributes.Length = 48;
ObjectAttributes.ObjectName = &v98;
ObjectAttributes.RootDirectory = v16;
ObjectAttributes.Attributes = 576;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
RegistryKeyInformation = ZwOpenKey(
&SourceKeyHandle,
0x20019ui64,
&ObjectAttributes,
v63,
Length,
(INT64)ResultLengthc,
(INT64)ValueSizeResult,
(INT64)ValueDataResult);
if( RegistryKeyInformation < 0 )
goto LABEL_190;
v64 = SourceKeyHandle;
}
v65 = v101;
LODWORD(v65) = v101 | 0x40000000;
PiDevCfgPushCopyKeyEntry(v14, v64, TargetKeyHandle, v65);
RegistryKeyInformation = v66;
if( v66 < 0 )
{
LABEL_190:
ZwClose((_HANDLE)TargetKeyHandle);
goto LABEL_85;
}
SourceKeyHandle = 0i64;
TargetKeyHandle = 0i64;
}
v67 = -1i64;
do
++v67;
while( v19[v67] );
v19 += v67 + 1;
if( !*v19 )
goto LABEL_86;
continue;
}
}
LABEL_15:
if( Information )
ExFreePoolWithTag(Information, 0);
if( v15 )
ExFreePoolWithTag(v15, 0);
LABEL_19:
if( SourceKeyHandle )
ZwClose((_HANDLE)SourceKeyHandle);
if( TargetKeyHandle )
ZwClose((_HANDLE)TargetKeyHandle);
return RegistryKeyInformation;
}Referenced by:
PiDevCfgConfigureDeviceInterface
PiDevCfgConfigureDeviceKeyCallback
PiDevCfgCopyDeviceKeys
PiDevCfgResetDeviceKeyCallback